@@ -7,24 +7,7 @@ import {
 } from '@/lib/api/server/routes'
 import { exportAuditLogs } from '@/lib/audit-logs/application/export-audit-logs'
 import { auditLogOperations } from '@/lib/audit-logs/application/operations'
-import { formatCsvValue, toCsvRow } from '@/lib/core/utils/csv'
-
-const CSV_HEADER = toCsvRow([
-  'Date',
-  'Action',
-  'Resource Type',
-  'Resource Name',
-  'Actor',
-  'Description',
-  'Event ID',
-  'Workspace ID',
-  'Resource ID',
-  'Actor ID',
-  'IP Address',
-  'User Agent',
-  'Surface',
-  'Metadata',
-])
+import { AUDIT_LOG_CSV_HEADER, toAuditLogCsvRow } from '@/lib/audit-logs/csv'
 
 export const GET = defineInternalBinaryRoute({
   contract: exportAuditLogsContract,
@@ -38,29 +21,7 @@ export const GET = defineInternalBinaryRoute({
   },
   useCase: exportAuditLogs,
   present: ({ rows, truncated }) => ({
-    body: [
-      CSV_HEADER,
-      ...rows.map((row) =>
-        toCsvRow(
-          [
-            row.createdAt,
-            row.action,
-            row.resourceType,
-            row.resourceName,
-            row.actorEmail || row.actorName || 'System',
-            row.description,
-            row.id,
-            row.workspaceId,
-            row.resourceId,
-            row.actorId,
-            row.ipAddress,
-            row.userAgent,
-            row.surface,
-            row.metadata,
-          ].map((value) => formatCsvValue(value))
-        )
-      ),
-    ].join('\n'),
+    body: [AUDIT_LOG_CSV_HEADER, ...rows.map(toAuditLogCsvRow)].join('\n'),
     contentType: 'text/csv; charset=utf-8',
     contentDisposition: `attachment; filename="audit-logs-${new Date().toISOString().slice(0, 10)}.csv"`,
     headers: { 'Cache-Control': 'no-store', 'X-Export-Truncated': truncated ? '1' : '0' },
 
@@ -1,6 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import { defineAuthorizedAuditLogUseCase } from '@/lib/audit-logs/application/authorized-audit-log-use-case'
 import { auditLogOperations } from '@/lib/audit-logs/application/operations'
+import { AUDIT_LOG_CSV_HEADER, toAuditLogCsvRow } from '@/lib/audit-logs/csv'
 import {
   type AuditLogFilterParams,
   buildFilterConditions,
@@ -45,7 +46,7 @@ export const exportAuditLogs = defineAuthorizedAuditLogUseCase({
     const conditions = [scope, ...buildFilterConditions(input.filters)]
     const rows: Awaited<ReturnType<typeof queryAuditLogs>>['data'] = []
     let cursor: string | undefined
-    let bytes = 0
+    let bytes = Buffer.byteLength(AUDIT_LOG_CSV_HEADER, 'utf8')
     let truncated = false
     pages: while (rows.length < EXPORT_MAX_ROWS) {
       request?.signal?.throwIfAborted()
@@ -55,7 +56,7 @@ export const exportAuditLogs = defineAuthorizedAuditLogUseCase({
         cursor
       )
       for (const row of page.data) {
-        bytes += Buffer.byteLength(JSON.stringify(row), 'utf8')
+        bytes += Buffer.byteLength(toAuditLogCsvRow(row), 'utf8') + 1
         if (bytes > EXPORT_MAX_BYTES) {
           truncated = true
           break pages
 
@@ -0,0 +1,41 @@
+import type { queryAuditLogs } from '@/lib/audit-logs/query'
+import { formatCsvValue, toCsvRow } from '@/lib/core/utils/csv'
+
+export const AUDIT_LOG_CSV_HEADER = toCsvRow([
+  'Date',
+  'Action',
+  'Resource Type',
+  'Resource Name',
+  'Actor',
+  'Description',
+  'Event ID',
+  'Workspace ID',
+  'Resource ID',
+  'Actor ID',
+  'IP Address',
+  'User Agent',
+  'Surface',
+  'Metadata',
+])
+
+/** Formats the exported row identically for byte admission and the download response. */
+export function toAuditLogCsvRow(row: Awaited<ReturnType<typeof queryAuditLogs>>['data'][number]) {
+  return toCsvRow(
+    [
+      row.createdAt,
+      row.action,
+      row.resourceType,
+      row.resourceName,
+      row.actorEmail || row.actorName || 'System',
+      row.description,
+      row.id,
+      row.workspaceId,
+      row.resourceId,
+      row.actorId,
+      row.ipAddress,
+      row.userAgent,
+      row.surface,
+      row.metadata,
+    ].map((value) => formatCsvValue(value))
+  )
+}
@@ -117,4 +117,31 @@ describe('Organization audit CSV export in PostgreSQL', () => {
     )
     expect(response.status).toBe(400)
   })
+
+  it('bounds encoded CSV bytes and marks quote-heavy metadata as truncated', async () => {
+    const { db, schema, eq } = runtime
+    await db
+      .update(schema.auditLog)
+      .set({
+        metadata: { organizationId, fixture: '"'.repeat(24_000_000) },
+      })
+      .where(eq(schema.auditLog.id, eventId))
+    try {
+      const response = await runtime.GET(
+        new NextRequest(
+          `http://localhost:3000/api/audit-logs/export?organizationId=${organizationId}&includeDeparted=true&actorId=${departedId}`
+        )
+      )
+      expect(response.status).toBe(200)
+      const csv = await response.arrayBuffer()
+      expect(csv.byteLength).toBeLessThanOrEqual(64 * 1024 * 1024)
+      expect(response.headers.get('x-export-truncated')).toBe('1')
+      expect(Buffer.from(csv).toString('utf8')).not.toContain(eventId)
+    } finally {
+      await db
+        .update(schema.auditLog)
+        .set({ metadata: { organizationId, changedFields: ['name'] } })
+        .where(eq(schema.auditLog.id, eventId))
+    }
+  })
 })
@@ -224,6 +224,48 @@ describe('authentication audit history in PostgreSQL', () => {
     expect((await history()).some((event) => event.action === 'auth.login_succeeded')).toBe(false)
   })
 
+  it.each([
+    { path: '/sign-in/email', action: 'auth.login_failed' },
+    { path: '/request-password-reset', action: 'password.reset_requested' },
+  ])('omits ambiguous legacy email provenance for $action', async ({ path, action }) => {
+    const collisionId = generateId()
+    additionalUserIds.push(collisionId)
+    await db.insert(user).values({
+      id: collisionId,
+      name: 'Legacy authentication fixture',
+      email: email.toUpperCase(),
+      emailVerified: true,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    })
+    await db
+      .insert(member)
+      .values({ id: generateId(), userId: collisionId, organizationId, role: 'member' })
+    const agent = `Authentication collision fixture ${generateId()}`
+    const attempt = request(path, {
+      email,
+      password: 'incorrect-fixture-password',
+      redirectTo: 'http://localhost:3000/reset-password',
+    })
+    attempt.headers.set('user-agent', agent)
+    try {
+      const response = await auth.handler(attempt)
+      expect(response.status).toBe(path === '/sign-in/email' ? 401 : 200)
+      const events = () => db.select().from(auditLog).where(eq(auditLog.userAgent, agent))
+      await expect
+        .poll(async () => (await events()).filter((event) => event.action === action).length)
+        .toBe(1)
+      const event = (await events()).find((event) => event.action === action)
+      if (!event) throw new Error('Authentication audit event missing')
+      expect(event.actorId).toBeNull()
+      expect(event.resourceId).toBeNull()
+      expect(event.metadata).not.toHaveProperty('targetUserId')
+      expect(event.metadata).not.toHaveProperty('organizationId')
+    } finally {
+      await db.delete(auditLog).where(eq(auditLog.userAgent, agent))
+    }
+  })
+
   it('attributes a password-reset request to its unauthenticated requester and the target organization', async () => {
     const response = await resetPassword(
       createMockRequest({
 
@@ -65,18 +65,23 @@ function isFailureRedirect(location: string | null | undefined): boolean {
 async function loadSubject(input: { userId?: string; email?: unknown }) {
   const email = typeof input.email === 'string' ? input.email.trim().toLowerCase() : undefined
   if (!input.userId && !email) return undefined
-  const [subject] = await db
+  const subjects = await db
     .select({
       id: user.id,
       name: user.name,
       email: user.email,
-      organizationId: member.organizationId,
     })
     .from(user)
-    .leftJoin(member, eq(member.userId, user.id))
     .where(input.userId ? eq(user.id, input.userId) : eq(foldedEmail(user.email), email ?? ''))
+    .limit(2)
+  if (subjects.length !== 1) return undefined
+  const subject = subjects[0]
+  const [membership] = await db
+    .select({ organizationId: member.organizationId })
+    .from(member)
+    .where(eq(member.userId, subject.id))
     .limit(1)
-  return subject
+  return { ...subject, organizationId: membership?.organizationId }
 }
 
 /** Records final authentication outcomes without persisting request bodies or bearer credentials. */
@@ -178,21 +183,21 @@ export async function recordPasswordResetAudit(input: {
 }): Promise<void> {
   try {
     const subject = await loadSubject(input)
-    if (!subject) return
     const completed = input.kind === 'completed'
+    if (completed && !subject) return
     recordAudit({
-      actorId: completed ? subject.id : null,
-      actorName: completed ? subject.name : 'Unauthenticated requester',
-      actorEmail: completed ? subject.email : null,
+      actorId: completed && subject ? subject.id : null,
+      actorName: completed && subject ? subject.name : 'Unauthenticated requester',
+      actorEmail: completed && subject ? subject.email : null,
       action: completed ? AuditAction.PASSWORD_RESET : AuditAction.PASSWORD_RESET_REQUESTED,
       resourceType: AuditResourceType.PASSWORD,
-      resourceId: subject.id,
-      resourceName: subject.email,
+      resourceId: subject?.id,
+      resourceName: subject?.email,
       description: completed ? 'Password reset completed' : 'Password reset requested',
       metadata: {
         outcome: 'success',
-        ...(subject.organizationId ? { organizationId: subject.organizationId } : {}),
-        ...(!completed ? { targetUserId: subject.id } : {}),
+        ...(subject?.organizationId ? { organizationId: subject.organizationId } : {}),
+        ...(!completed && subject ? { targetUserId: subject.id } : {}),
       },
       request: input.request,
     })
 
@@ -35,6 +35,18 @@ try {
     })
     if (pinned.headers.get('x-via-proxy') !== 'yes') throw new Error('Pinned fetch bypassed proxy')
     if ((await pinned.text()) !== 'tls reached') throw new Error('Pinned fetch response mismatch')
+    const target = '/exports/../raw/event%2Fpart.ndjson?x-id=PutObject&token=%2B'
+    const signed = await secureFetchWithPinnedIP(`https://origin.invalid${target}`, '1.1.1.1', {
+      profile: 'selfHostedService',
+      requestTarget: target,
+      method: 'PUT',
+      body: '{"id":"event"}\n',
+      timeout: 10_000,
+    })
+    if (signed.headers.get('x-via-proxy') !== 'yes') throw new Error('Signed fetch bypassed proxy')
+    if (signed.headers.get('x-request-target') !== target) throw new Error('Signed target changed')
+    if ((await signed.text()) !== '{"id":"event"}\n')
+      throw new Error('Signed fetch response mismatch')
   })
 
   let rejected = false
 
@@ -43,11 +43,14 @@ const admissions: Array<{
 }> = []
 let originRequests = 0
 let receivedHeaders: Record<string, unknown> = {}
+let receivedTarget = ''
 const proxiedPorts = new Set<number>()
 const secureOrigin = httpsServer(async (req, res) => {
   res.setHeader('x-via-proxy', proxiedPorts.has(req.socket.remotePort ?? 0) ? 'yes' : 'no')
   originRequests++
   receivedHeaders = req.headers
+  receivedTarget = req.url ?? ''
+  res.setHeader('x-request-target', receivedTarget)
   if (req.url === '/redirect') {
     res.writeHead(302, { location: '/done' })
     res.end()
@@ -56,7 +59,7 @@ const secureOrigin = httpsServer(async (req, res) => {
   if (req.url === '/wait') return
   const chunks: Buffer[] = []
   for await (const chunk of req) chunks.push(Buffer.from(chunk))
-  res.end(req.method === 'POST' ? Buffer.concat(chunks) : 'tls reached')
+  res.end(req.method === 'POST' || req.method === 'PUT' ? Buffer.concat(chunks) : 'tls reached')
 })
 const proxy = httpsServer()
 proxy.on('connect', (req, socket, head) => {
@@ -150,6 +153,28 @@ const url = () => 'https://origin.invalid'
 const options = { profile: 'selfHostedService' as const }
 
 describe('organization gateways over real TLS CONNECT sockets', () => {
+  it('preserves signed request targets and origin authentication through the gateway', async () => {
+    const target = '/exports/../raw/audit_logs/event%2Fpart.ndjson?x-id=PutObject&token=%2B'
+    const response = await runWithOutboundOrganization('org_a', () =>
+      secureFetchWithPinnedIP(`${url()}${target}`, '1.1.1.1', {
+        ...options,
+        requestTarget: target,
+        method: 'PUT',
+        body: '{"id":"event"}\n',
+        headers: {
+          authorization: 'AWS4-HMAC-SHA256 signed-request',
+          'Proxy-Authorization': 'must-not-reach-origin',
+        },
+      })
+    )
+    expect(await response.text()).toBe('{"id":"event"}\n')
+    expect(response.headers.get('x-via-proxy')).toBe('yes')
+    expect(receivedTarget).toBe(target)
+    expect(receivedHeaders.authorization).toBe('AWS4-HMAC-SHA256 signed-request')
+    expect(receivedHeaders['proxy-authorization']).toBeUndefined()
+    expect(admissions.at(-1)?.destination).toBe('1.1.1.1:443')
+  })
+
   it('keeps an upgraded tunnel usable after five minutes', async () => {
     vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
     let tunnel: Socket | undefined
@@ -312,7 +337,7 @@ describe('organization gateways over real TLS CONNECT sockets', () => {
         },
       }
     )
-    expect(admissions.length).toBe(start + 3)
+    expect(admissions.length).toBe(start + 4)
     expect(
       admissions.slice(start).every((entry) => entry.token === `Bearer ${'a'.repeat(48)}`)
     ).toBe(true)
 
@@ -79,16 +79,27 @@ type OutboundRequestOptions = Omit<
 > & {
   headers?: Record<string, string>
   dispatcher: Dispatcher
+  requestTarget?: string
 }
 
 /**
  * The shared HTTP wire transport. Import the installed package explicitly: Bun's bare
  * undici shim ignores dispatchers. Proxy credentials never become destination headers.
  */
 export function requestWithOutboundDispatcher(url: string, options: OutboundRequestOptions) {
+  const { requestTarget, dispatcher, ...requestOptions } = options
   const headers = { ...options.headers }
   for (const name of Object.keys(headers)) {
     if (name.toLowerCase() === 'proxy-authorization') delete headers[name]
   }
-  return request(url, { ...options, headers })
+  if (requestTarget !== undefined) {
+    return dispatcher.request({
+      ...requestOptions,
+      origin: new URL(url).origin,
+      path: requestTarget,
+      method: requestOptions.method ?? 'GET',
+      headers,
+    })
+  }
+  return request(url, { ...requestOptions, dispatcher, headers })
 }